source: networking/netutils/wireshark.xml@ e022b07

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 12.2 9.1 gimp3 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/for-12.3 xry111/intltool xry111/llvm18 xry111/soup3 xry111/spidermonkey128 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since e022b07 was e022b07, checked in by Bruce Dubbs <bdubbs@…>, 5 years ago

Update to glib-2.62.4.
Update to exo-0.12.11.
Update to wireshark-3.2.0.
Update to NetworkManager-1.22.0.
Update to node-12.14.0.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22488 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 18.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY wireshark-download-http "https://www.wireshark.org/download/src/all-versions/wireshark-&wireshark-version;.tar.xz">
8 <!ENTITY wireshark-download-ftp " ">
9 <!ENTITY wireshark-md5sum "259915adbbaded15de075afe7b4b03b6">
10 <!ENTITY wireshark-size "30 MB">
11 <!ENTITY wireshark-buildsize "570 MB (with all optional dependencies available in the BLFS book)">
12 <!ENTITY wireshark-time "2.5 SBU (with parallelism=4 and all optional dependencies available in the BLFS book)">
13]>
14
15<sect1 id="wireshark" xreflabel="Wireshark-&wireshark-version;">
16 <?dbhtml filename="wireshark.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Wireshark-&wireshark-version;</title>
24
25 <indexterm zone="wireshark">
26 <primary sortas="a-Wireshark">Wireshark</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Wireshark</title>
31
32 <para>
33 The <application>Wireshark</application> package contains a network
34 protocol analyzer, also known as a <quote>sniffer</quote>. This is useful
35 for analyzing data captured <quote>off the wire</quote> from a live
36 network connection, or data read from a capture file.
37 </para>
38
39 <para>
40 <application>Wireshark</application> provides both a graphical and a
41 TTY-mode front-end for examining captured network packets from over 500
42 protocols, as well as the capability to read capture files from many
43 other popular network analyzers.
44 </para>
45
46 &lfs90_checked;
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&wireshark-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&wireshark-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &wireshark-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &wireshark-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &wireshark-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &wireshark-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing="compact">
72 <listitem>
73 <para>
74 Additional Documentation:
75 <ulink url="https://www.wireshark.org/download/docs/"/>
76 (contains links to several different docs in a variety of formats)
77 </para>
78 </listitem>
79 </itemizedlist>
80
81 <bridgehead renderas="sect3">Wireshark dependencies</bridgehead>
82
83 <bridgehead renderas="sect4">Required</bridgehead>
84 <para role="required">
85 <xref linkend="glib2"/>,
86 <xref linkend="libgcrypt"/>, and
87 <xref linkend="qt5"/>
88 </para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended">
92 <xref linkend="libpcap"/> (required to capture data)
93 </para>
94
95 <bridgehead renderas="sect4">Optional</bridgehead>
96 <para role="optional">
97 <xref linkend="c-ares"/>,
98 <xref linkend="doxygen"/>,
99 <xref linkend="git"/>,
100 <xref linkend="gnutls"/>,
101 <xref linkend="libnl"/>,
102 <xref linkend="libxslt"/>,
103 <xref linkend="libxml2"/>,
104 <xref linkend="lua52"/>,
105 <xref linkend="mitkrb"/>,
106 <xref linkend="nghttp2"/>,
107 <xref linkend="sbc"/>,
108 <ulink url="https://asciidoctor.org/">Asciidoctor</ulink>,
109 <ulink url="https://www.linphone.org/technical-corner/bcg729">BCG729</ulink>,
110 <ulink url="http://www.ibr.cs.tu-bs.de/projects/libsmi/">libsmi</ulink>,
111 <ulink url="http://lz4.github.io/lz4/">lz4</ulink>,
112 <ulink url="https://www.libssh.org/">libssh</ulink>,
113 <ulink url="https://github.com/maxmind/libmaxminddb">MaxMindDB</ulink>,
114 <ulink url="http://google.github.io/snappy/">Snappy</ulink>, and
115 <ulink url="https://www.soft-switch.org/">Spandsp</ulink>
116 </para>
117
118 <para condition="html" role="usernotes">
119 User Notes: <ulink url="&blfs-wiki;/wireshark"/>
120 </para>
121
122 </sect2>
123
124 <sect2 role="kernel" id="wireshark-kernel">
125 <title>Kernel Configuration</title>
126
127 <para>
128 The kernel must have the Packet protocol enabled for <application>
129 Wireshark</application> to capture live packets from the network:
130 </para>
131
132<screen><literal>[*] Networking support ---&gt; [CONFIG_NET]
133 Networking options ---&gt;
134 &lt;*/M&gt; Packet socket [CONFIG_PACKET]</literal></screen>
135
136 <para>
137 If built as a module, the name is <filename>af_packet.ko</filename>.
138 </para>
139
140 <indexterm zone="wireshark wireshark-kernel">
141 <primary sortas="d-Capturing-network-packets">
142 Capturing network packets
143 </primary>
144 </indexterm>
145
146 </sect2>
147
148 <sect2 role="installation">
149 <title>Installation of Wireshark</title>
150
151 <para>
152 <application>Wireshark</application> is a very large and complex
153 application. These instructions provide additional security measures to
154 ensure that only trusted users are allowed to view network traffic. First,
155 set up a system group for wireshark. As the <systemitem
156 class="username">root</systemitem> user:
157 </para>
158
159<screen role="root"><userinput>groupadd -g 62 wireshark</userinput></screen>
160
161 <para>
162 Continue to install <application>Wireshark</application> by running
163 the following commands:
164 </para>
165
166<screen><userinput>mkdir build &amp;&amp;
167cd build &amp;&amp;
168
169cmake -DCMAKE_INSTALL_PREFIX=/usr \
170 -DCMAKE_BUILD_TYPE=Release \
171 -DCMAKE_INSTALL_DOCDIR=/usr/share/doc/wireshark-&wireshark-version; \
172 -G Ninja \
173 .. &amp;&amp;
174ninja</userinput></screen>
175
176 <para>
177 This package does not come with a test suite.
178 </para>
179
180 <para>
181 Now, as the <systemitem class="username">root</systemitem> user:
182 </para>
183
184<screen role="root"><userinput>ninja install &amp;&amp;
185
186install -v -m755 -d /usr/share/doc/wireshark-&wireshark-version; &amp;&amp;
187install -v -m644 ../README.linux ../doc/README.* ../doc/{*.pod,randpkt.txt} \
188 /usr/share/doc/wireshark-&wireshark-version; &amp;&amp;
189
190pushd /usr/share/doc/wireshark-&wireshark-version; &amp;&amp;
191 for FILENAME in ../../wireshark/*.html; do
192 ln -s -v -f $FILENAME .
193 done &amp;&amp;
194popd
195unset FILENAME</userinput></screen>
196
197 <para>
198 If you downloaded any of the documentation files from the page
199 listed in the 'Additional Downloads', install them by issuing the
200 following commands as the <systemitem class="username">root</systemitem>
201 user:
202 </para>
203
204<screen role="root"
205 remap="doc"><userinput>install -v -m644 <replaceable>&lt;Downloaded_Files&gt;</replaceable> \
206 /usr/share/doc/wireshark-&wireshark-version;</userinput></screen>
207
208 <para>
209 Now, set ownership and permissions of sensitive applications to only
210 allow authorized users. As the <systemitem class="username">root
211 </systemitem> user:
212 </para>
213
214<screen role="root"><userinput>chown -v root:wireshark /usr/bin/{tshark,dumpcap} &amp;&amp;
215chmod -v 6550 /usr/bin/{tshark,dumpcap}</userinput></screen>
216
217 <para>
218 Finally, add any users to the wireshark group (as <systemitem class=
219 "username">root</systemitem> user):
220 </para>
221
222 <screen role="root"><userinput>usermod -a -G wireshark <replaceable>&lt;username&gt;</replaceable></userinput></screen>
223
224 <para>
225 If you are installing wireshark for the first time, it will be necessary
226 to leave the session and login again, thus you will now have wireshark
227 between your groups, otherwise, it will not run properly.
228 </para>
229
230 </sect2>
231<!--
232 <sect2 role="commands">
233 <title>Command Explanations</title>
234
235 <para>
236 <option>- -disable-wireshark</option>: Use this switch if you
237 have <application>Qt</application> installed but do not want to build
238 any of the GUIs.
239 </para>
240 </sect2>
241-->
242
243 <sect2 role="configuration">
244 <title>Configuring Wireshark</title>
245
246 <sect3 id="wireshark-config">
247 <title>Config Files</title>
248
249 <para><filename>/etc/wireshark.conf</filename> and
250 <filename>~/.config/wireshark/*</filename> (unless there is already
251 <filename>~/.wireshark/*</filename> in the system)</para>
252
253 <indexterm zone="wireshark wireshark-config">
254 <primary sortas="e-AA.wireshark-star">~/.wireshark/*</primary>
255 </indexterm>
256
257 <indexterm zone="wireshark wireshark-config">
258 <primary sortas="e-etc-wireshark.conf">/etc/wireshark.conf</primary>
259 </indexterm>
260
261 </sect3>
262
263 <sect3>
264 <title>Configuration Information</title>
265
266 <para>Though the default configuration parameters are very sane, reference
267 the configuration section of the <ulink
268 url="http://www.wireshark.org/docs/wsug_html/">Wireshark User's
269 Guide</ulink> for configuration information. Most of
270 <application>Wireshark</application>'s configuration can be accomplished
271 using the menu options of the <command>wireshark</command> graphical
272 interfaces.</para>
273
274 <note>
275 <para>If you want to look at packets, make sure you don't filter them
276 out with <xref linkend="iptables"/>. If you want to exclude certain
277 classes of packets, it is more efficient to do it with
278 <application>iptables</application> than it is with
279 <application>Wireshark</application>.</para>
280 </note>
281
282 </sect3>
283
284 </sect2>
285
286 <sect2 role="content">
287 <title>Contents</title>
288
289 <segmentedlist>
290 <segtitle>Installed Programs</segtitle>
291 <segtitle>Installed Libraries</segtitle>
292 <segtitle>Installed Directories</segtitle>
293
294 <seglistitem>
295 <seg>
296 capinfos, captype, dumpcap, editcap, idl2wrs,
297 mergecap, randpkt, rawshark, reordercap, sharkd,
298 text2pcap, tshark, and wireshark
299 </seg>
300 <seg>
301 libwireshark.so, libwiretap.so, libwscodecs.so,
302 libwsutil.so, and numerous modules under /usr/lib/wireshark/plugins
303 </seg>
304 <seg>
305 /usr/{include,lib,share}/wireshark and
306 /usr/share/doc/wireshark-&wireshark-version;
307 </seg>
308 </seglistitem>
309 </segmentedlist>
310
311 <variablelist>
312 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
313 <?dbfo list-presentation="list"?>
314 <?dbhtml list-presentation="table"?>
315
316 <varlistentry id="capinfos">
317 <term><command>capinfos</command></term>
318 <listitem>
319 <para>reads a saved capture file and returns any or all of several
320 statistics about that file. It is able to detect and read any capture
321 supported by the <application>Wireshark</application> package.</para>
322 <indexterm zone="wireshark capinfos">
323 <primary sortas="b-capinfos">capinfos</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 <varlistentry id="captype">
329 <term><command>captype</command></term>
330 <listitem>
331 <para>prints the file types of capture files.</para>
332 <indexterm zone="wireshark captype">
333 <primary sortas="b-captype">captype</primary>
334 </indexterm>
335 </listitem>
336 </varlistentry>
337
338 <varlistentry id="dumpcap">
339 <term><command>dumpcap</command></term>
340 <listitem>
341 <para>is a network traffic dump tool. It lets you capture packet data
342 from a live network and write the packets to a file.</para>
343 <indexterm zone="wireshark dumpcap">
344 <primary sortas="b-dumpcap">dumpcap</primary>
345 </indexterm>
346 </listitem>
347 </varlistentry>
348
349 <varlistentry id="editcap">
350 <term><command>editcap</command></term>
351 <listitem>
352 <para>edits and/or translates the format of capture files. It knows
353 how to read <application>libpcap</application> capture files,
354 including those of <command>tcpdump</command>,
355 <application>Wireshark</application> and other tools that write
356 captures in that format.</para>
357 <indexterm zone="wireshark editcap">
358 <primary sortas="b-editcap">editcap</primary>
359 </indexterm>
360 </listitem>
361 </varlistentry>
362
363 <varlistentry id="idl2wrs">
364 <term><command>idl2wrs</command></term>
365 <listitem>
366 <para>is a program that takes a user specified CORBA IDL file and
367 generates <quote>C</quote> source code for a
368 <application>Wireshark</application> <quote>plugin</quote>. It relies
369 on two Python programs <command>wireshark_be.py</command> and
370 <command>wireshark_gen.py</command>, which are not installed
371 by default. They have to be copied manually from the <filename
372 class="directory">tools</filename> directory to the <filename
373 class="directory">$PYTHONPATH/site-packages/</filename> directory.
374 </para>
375 <indexterm zone="wireshark idl2wrs">
376 <primary sortas="b-idl2wrs">idl2wrs</primary>
377 </indexterm>
378 </listitem>
379 </varlistentry>
380
381 <varlistentry id="mergecap">
382 <term><command>mergecap</command></term>
383 <listitem>
384 <para>combines multiple saved capture files into a single output
385 file.</para>
386 <indexterm zone="wireshark mergecap">
387 <primary sortas="b-mergecap">mergecap</primary>
388 </indexterm>
389 </listitem>
390 </varlistentry>
391
392 <varlistentry id="randpkt">
393 <term><command>randpkt</command></term>
394 <listitem>
395 <para>creates random-packet capture files.</para>
396 <indexterm zone="wireshark randpkt">
397 <primary sortas="b-randpkt">randpkt</primary>
398 </indexterm>
399 </listitem>
400 </varlistentry>
401
402 <varlistentry id="rawshark">
403 <term><command>rawshark</command></term>
404 <listitem>
405 <para>dump and analyze raw libpcap data.</para>
406 <indexterm zone="wireshark rawshark">
407 <primary sortas="b-rawshark">rawshark</primary>
408 </indexterm>
409 </listitem>
410 </varlistentry>
411
412 <varlistentry id="reordercap">
413 <term><command>reordercap</command></term>
414 <listitem>
415 <para>reorder timestamps of input file frames into output file.</para>
416 <indexterm zone="wireshark reordercap">
417 <primary sortas="b-reordercap">reordercap</primary>
418 </indexterm>
419 </listitem>
420 </varlistentry>
421
422 <varlistentry id="sharkd">
423 <term><command>sharkd</command></term>
424 <listitem>
425 <para>is a daemon that listens on UNIX sockets.</para>
426 <indexterm zone="wireshark sharkd">
427 <primary sortas="b-sharkd">sharkd</primary>
428 </indexterm>
429 </listitem>
430 </varlistentry>
431
432 <varlistentry id="text2pcap">
433 <term><command>text2pcap</command></term>
434 <listitem>
435 <para>reads in an ASCII hex dump and writes the
436 data described into a <application>libpcap</application>-style
437 capture file.</para>
438 <indexterm zone="wireshark text2pcap">
439 <primary sortas="b-text2pcap">text2pcap</primary>
440 </indexterm>
441 </listitem>
442 </varlistentry>
443
444 <varlistentry id="tshark">
445 <term><command>tshark</command></term>
446 <listitem>
447 <para>is a TTY-mode network protocol analyzer. It lets you capture
448 packet data from a live network or read packets from a
449 previously saved capture file.</para>
450 <indexterm zone="wireshark tshark">
451 <primary sortas="b-tshark">tshark</primary>
452 </indexterm>
453 </listitem>
454 </varlistentry>
455
456 <varlistentry id="wireshark-prog">
457 <term><command>wireshark</command></term>
458 <listitem>
459 <para>
460 is the Qt GUI network protocol analyzer. It lets you interactively
461 browse packet data from a live network or from a previously saved
462 capture file.
463 </para>
464 <indexterm zone="wireshark wireshark-prog">
465 <primary sortas="b-wireshark">wireshark</primary>
466 </indexterm>
467 </listitem>
468 </varlistentry>
469
470 <varlistentry id="wireshark-gtk-prog">
471 <term><command>wireshark-gtk</command></term>
472 <listitem>
473 <para>
474 is the Gtk+ GUI network protocol analyzer. It lets you interactively
475 browse packet data from a live network or from a previously saved
476 capture file (optional).
477 </para>
478 <indexterm zone="wireshark wireshark-gtk-prog">
479 <primary sortas="b-wireshark-gtk">wireshark-gtk</primary>
480 </indexterm>
481 </listitem>
482 </varlistentry>
483
484 <varlistentry id="libwireshark">
485 <term><filename class='libraryfile'>libwireshark.so</filename></term>
486 <listitem>
487 <para>contains functions used by the
488 <application>Wireshark</application> programs to perform filtering and
489 packet capturing.</para>
490 <indexterm zone="wireshark libwireshark">
491 <primary sortas="c-libwireshark">libwireshark.so</primary>
492 </indexterm>
493 </listitem>
494 </varlistentry>
495
496 <varlistentry id="libwiretap">
497 <term><filename class='libraryfile'>libwiretap.so</filename></term>
498 <listitem>
499 <para>is a library being developed as a future replacement for
500 <filename class='libraryfile'>libpcap</filename>, the current
501 standard Unix library for packet capturing. For more information,
502 see the <filename>README</filename> file in the source
503 <filename class='directory'>wiretap</filename> directory.</para>
504 <indexterm zone="wireshark libwiretap">
505 <primary sortas="c-libwiretap">libwiretap.so</primary>
506 </indexterm>
507 </listitem>
508 </varlistentry>
509
510 </variablelist>
511
512 </sect2>
513
514</sect1>
Note: See TracBrowser for help on using the repository browser.